Resources for the Check Point Community, by the Check Point Community.

Tim Hall has done it again! He has just released the 2nd edition of "Max Power".Rather than get into details here, I urge you to check out this announcement post. It's a massive upgrade, and well worth checking out. -E

If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

deleting Index directories in /var/log/opt/CPSmartLog-R76/data

when deleting log files on a R76 FW, the files are deleted but this does not decrease disk space. Is it save to delete the (not used) index directories in /var/log/opt/CPSmartLog-R76/data to save space?
The issue is described here https://supportcenter.checkpoint.com...ionid=sk114114
(but the solution is not accessible)

Re: deleting Index directories in /var/log/opt/CPSmartLog-R76/data

Generally, if you unlink a file and your used disk space doesn't go down, some process still has the file open. You can try 'cprestart' to restart all of the Check Point services. WARNING! If this is a firewall (and not just a SmartCenter), it will stop passing traffic while services are restarted.

You can use 'lsof' to LiSt Open Files and search for your log files. The ones you've deleted probably won't show up, but the process probably has others from the same directory open, too. Depending on the specific process, you may be able to just SIGHUP it, or it may need to be restarted by some other method.

Re: deleting Index directories in /var/log/opt/CPSmartLog-R76/data

I would recommend deleting log files ($FWDIR/log/) until you still have logs for a time period you feel comfortable with, then deleting all smart log indexes as well as $SMARTLOGDIR/data/FetchedFiles and let Smart Log rebuild its index from scratch. Create a cron job that will delete logs older then X days daily. Configure $SMARTLOGDIR/smartlog_settings.txt to limit disk usage for index files (or better, update to at least R77.30 and configure it from Smart Dashboard).

See sk73361 (How to delete the index in SmartLog) and sk96546 (How to control SmartLog disk (disc) usage on SmartLog R77.30 and lower).